MALICIOUS — 4980ee_16ebbf415e074f1a971a4d30c5d9f5e7.pdf
MALICIOUS — 4980ee_16ebbf415e074f1a971a4d30c5d9f5e7.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 5 of 53 detection engines flagged it.
Identification
- SHA-256:
4f0e023754a98700420628f51ff0a91150cb88058ef54c29e326d13c732ac8a6 - SHA-1:
ca638d623d396fb248eb7ade9bca8b1a937f15fb - MD5:
24b430679203a15f7f7c49788465660a - ssdeep:
1536:O/5oKvRhJ24xz1MK+/aZcHKU4CoOlhU4wsv9OF87lPA4c9:eoTwhMhiU4KlxwsvO8mL - TLSH:
T12E38C0F32147EDDC6E8BAB4395B715AD508AE3C572319BA00088B27D85B86FD3F20542 - Submitted as: 4980ee_16ebbf415e074f1a971a4d30c5d9f5e7.pdf
- File type: pdf · Size: 83163 bytes
- Verdict: malicious (92/100)
Detections (5 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- ClamAV (daily): Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0
- Emsisoft (Emergency Kit): PDF.Spam.Heur.1
- Trellix Stinger (McAfee): PDF/Phish-FAB!24B430679203
- Kaspersky (KVRT): HEUR:Hoax.PDF.Phish.gen
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0 (rule
Pdf.Phishing.Trojan-d2528dad23a95d95-d2528dad23a95d95-10044376-0) - engine signal, weight 0.90, confidence 0.95 - Embedded network infrastructure: https://gimoguvi.ru/wix?keyword=vistas+student+activities+manual+answer+key+pdf, https://ziwopigop.weebly.com/uploads/1/3/4/3/134380455/dunadumejaxijin_lotolid.pdf, https://leduxuma.weebly.com/uploads/1/3/2/8/132814900/nesixagebodun_xudenuji_guganegerorusox_sivamevexalijef.pdf - static signal, weight 0.35, confidence 0.60
- Document active content: uri-action - static signal, weight 0.30, confidence 0.60
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
Embedded URLs
- https://gimoguvi.ru/wix?keyword=vistas+student+activities+manual+answer+key+pdf
- https://ziwopigop.weebly.com/uploads/1/3/4/3/134380455/dunadumejaxijin_lotolid.pdf
- https://leduxuma.weebly.com/uploads/1/3/2/8/132814900/nesixagebodun_xudenuji_guganegerorusox_sivamevexalijef.pdf
- https://uploads.strikinglycdn.com/files/d5a3f769-0479-48be-85a7-fde4098231ca/41027071086.pdf
- https://uploads.strikinglycdn.com/files/443c21ac-5917-4493-b571-e2c7df8be4f3/over_the_rainbow_ukulele_sheet_music.pdf
- http://future-techno.ru/watch_divergent_online_free_gomoviesxc6el.pdf
- https://cdn.sqhk.co/naboxolat/bmjdGhh/83796914315.pdf
- https://nupinegudoxaxu.weebly.com/uploads/1/3/5/3/135350485/fovagogageme.pdf
- https://uploads.strikinglycdn.com/files/7799aecc-bf90-4234-9375-a7201ff54d9a/goralakov.pdf
- https://uploads.strikinglycdn.com/files/de83018f-b3f3-435b-9dd7-140a5ce6430c/48454811180.pdf
- https://ruwatija.weebly.com/uploads/1/3/4/8/134846771/188722.pdf
- https://uploads.strikinglycdn.com/files/08f75ec1-6f05-4331-843d-e561fa293e78/area_calculation_of_trapezoidal_footing.pdf
- https://vesanalu.weebly.com/uploads/1/3/1/4/131482823/motedutin.pdf
- https://xuredetinumimo.weebly.com/uploads/1/3/4/6/134630251/wapuzo_rinopew.pdf
- https://cdn.sqhk.co/kuwusemob/D8ifij3/27208998277.pdf
- https://munojafejim.weebly.com/uploads/1/3/0/8/130874523/180f5.pdf
- http://profapp.pro/2015_chevy_trax_lt_owners_manualizqi0.pdf
- https://uploads.strikinglycdn.com/files/92721f41-c16d-4819-aeb9-30de830dcb77/how_to_have_your_child_tested_for_adhd.pdf
- https://cdn.sqhk.co/vedanoderifu/djgjbhi/zoditediwidibozab.pdf
- https://uploads.strikinglycdn.com/files/81b7f710-e8e4-4187-aa4d-421480bd1159/76855197652.pdf
- https://uploads.strikinglycdn.com/files/46cdf181-cf66-4e66-87d0-007a724e6160/how_to_set_stopwatch.pdf
- https://uploads.strikinglycdn.com/files/38ec06e4-fbf0-4b9d-ab97-d27db1a59116/togituzetadizavore.pdf
- http://academic-club.ru/kudetimazadawokitorexarem00fby.pdf
- http://www.w3.org/1999/02/22-rdf-syntax-ns#
- http://purl.org/dc/elements/1.1/
Embedded domains
- gimoguvi.ru
- ziwopigop.weebly.com
- leduxuma.weebly.com
- uploads.strikinglycdn.com
- future-techno.ru
- cdn.sqhk.co
- nupinegudoxaxu.weebly.com
- ruwatija.weebly.com
- vesanalu.weebly.com
- xuredetinumimo.weebly.com
- munojafejim.weebly.com
- profapp.pro
- academic-club.ru
- www.w3.org
- purl.org
- ns.adobe.com
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report